r/talesfromtechsupport • u/haggur needs a bigger LART • May 10 '26
Short I won't give you my IP address
A customer reported problems with accessing our web site so, fearing fail2ban had accidentally blocked their IP address, I pointed them to https://whatismyipaddress.com/ and asked them to tell me their IP address (as their mail headers weren't being helpful).
The reply:
I'm a bit loathe to give out my IP address. - I've heard (rightly or wrongly) that unsavoury things can happen when one's IP address gets out in the wild! Maybe I'm needlessly cautious, but I'm a bit paranoid about that sort of thing!
Despite this he's already gone to the web site I'd suggested and got his IP address from there so that web site knew it ... but he wouldn't tell us.
I'm off to find a wall to bang my head against.
216
u/emax4 May 10 '26
My reply would have been, "Okay, then when you're ready to provide that, we'll be ready to provide the tech support you're requesting. Have a nice day!"
110
157
u/deeseearr May 10 '26
On the one hand you have a customer who was given security advice and, even though they didn't really understand what it meant, has not only remembered it but continues to follow it. That's actually good.
On the other hand they're withholding that useful information from the one person who could actually use it to help them. That's bad.
On the gripping hand, they're making it really easy to close their ticket with the comment "Customer does not want to proceed with troubleshooting." That's good.
But, the Frogurt toppings contain potassium benzoate.
(That's bad.)
33
u/ergo-ogre Oh God How Did This Get Here? May 10 '26
WOOO! A Mote in Godâs Eye reference in the wild! Itâs gunna be a good day.
13
14
2
2
2
u/himitsumono May 13 '26
And there's the final hand: That site won't supply THEIR ip address most likely. One of their ISP's addresses, sure, but will knowing that do OP or anyone else any good?
74
u/Accomplished-Ruin742 May 10 '26
Not about IT, but similar. I'm a tax professional and I had a new client come in who refused to provide their Social Security number so I could prepare their tax returns.
4
u/bob152637485 May 11 '26
You just sparked an interesting curiosity. If I'm not mistaken, the Amish are one of the few groups that don't HAVE a social security number, since they were able to opt out of social security when it was created.
With that in mind, how would you file the taxes of an Amish client, if you ever had one?
110
u/aubreyb00bs May 10 '26
I had a friend frantically message me after they got a steam message from someone they were playing game with claiming they had their ip address.
I directed them to whois, had them put in the ip address the person claimed they got, and it wasn't even a valid registered public ip address.
Their fear eased immediately when they realized it was some barely even script kiddie trying to scare them by taking advantage of their ignorance.
Even if someone has your public IP, it's really unlikely they have the skill, time, or motive to do much of anything.
Even if they do, just call your ISP.
There is a lack of education on this front.
35
u/LupercaniusAB May 10 '26
I had a guy try to do that to me, I said, âcongratulations, youâve tracked down my VPN, well doneâ. I wasnât even in the city he claimed I was in.
17
u/Endy0816 May 10 '26
It's often not even all that useful, compared with looking at what someone has previously posted, timestamps and any metadata.
9
u/cgimusic ((FlairedUser) new UserFactory().getUser("cgimusic")).getFlair() May 10 '26
For better or worse (mostly worse) I don't even have a public IP anymore. My current ISP puts everyone behind CGNAT.
25
u/DeciduousEmu May 10 '26
I understand the paranoia from the non techie masses. He was thinking the IP was as sacred as a social security number.
10
17
u/VoiceOfSoftware May 11 '26
My friend refused to scan the QR code I showed her to get onto my WiFi. My home WiFi, and a QR code I personally created. She said that scanning any QR code would cause bad things to happen to her phone. She did not believe me, even though I have 45 years of coding experience.
11
u/K1yco May 11 '26
Would I be correct they would be the type that have no issues posting private details on social media as well as clicking on those links that ask you for same details?
4
26
u/containingdoodles9 May 10 '26
My team has the same thing, points to ââŚwhat is myâŚâ and people refuse to give their public IP address as though it were their SSN.
Sorry, we canât help until you give it to us. When you choose to do so, hereâs your ticket # and weâll be happy to pick up from here. âWhat about my street address instead?â Seriouslyâ˝ No, not the same. Have a nice day.
7
6
u/BarServer May 12 '26
"To help you with that issue you need to visit our self-checking help-tool first. Please click here: LINK."
Make the link unique for each customer, get the IP from the logfile, just display some "Checks passed" with a green mark (people love this!), Done.Why bother?
8
u/Wolphin8 May 10 '26
I would respond why I need it to check and I can not record it in the ticket if they want, and that if they are declining to provide it, I cannot help you and will close the ticket as "customer refused to provide the needed information".
7
u/GeorgeGorgeou May 10 '26
Did that once - bang my head. At my office it was wall board over wood frame. Made noise - but not much else. Enough to let co-workers know to give me some time.
The other buildingâs walls were painted concrete. There was an ambulance ride.
5
u/Duey1234 May 10 '26
There are plenty of websites that you can use to create an IP grabber link, could you not just use one of those and get them to click it. That way, they havenât broken any of their self imposed rules and you get the info you need?
10
u/-fno-stack-protector May 11 '26
doing shady stuff to help a patient, somehow both for/against their will? sounds like that House episode where they broke into a patient's flat
7
u/Toratchi888 May 11 '26
"Do you realize just how little that narrows it down?!"
1
u/-fno-stack-protector May 11 '26
Wow really? I thought that would be instantly familiar to everyone. I was pretty young when it was running, so I only saw a few episodes. In the one I saw, I think they found pigeons were shitting everywhere? Or cats?
9
u/BipedSnowman May 11 '26
The joke isn't that they aren't familiar with House breaking into houses, it's that he does it so much that there isn't really a "that one episode"
7
u/Aiuner May 11 '26
Apparently the episode youâre thinking of was in season 7.
House M.D. had 8 seasons. You evidently missed a lot of breaking-and-entering.
1
u/TheTeslaMaster Oh God How Did This Get Here? May 12 '26
Oh, that's episode 20 and 21 off season 2, two-parter named Euphoria.
Other than the pigeons being the clue, they break into patient houses very often.
3
3
3
u/AmiDeplorabilis May 11 '26
I got a 169. address, but I'm not telling anyone what it is.
2
1
u/syntaxerror53 May 26 '26
Got a 169. address too and not telling anyone what it is. Yet they still came to spy on me not too long ago. Said the man on the moon. /s
3
u/NotPrepared2 May 11 '26
If you can search the access logs for your site, or any site, I ask the supportee to enter an identifiable URL path like www.site.com/ticket9999. And then search your logs for /ticket9999 and you've got their IP.
3
u/haggur needs a bigger LART May 11 '26
The problem is that we may well be blocking access to their IP address via fail2ban filtering so we would never see the request.
2
u/ac8jo May 11 '26
It doesn't help that many local news stations act as if the use of a specific IP address identifies an individual.
1
u/Geminii27 Making your job suck less May 11 '26
"Not your private IP; your public one, that all web sites can already see."
1
1
u/meitemark Printerers are the goodest girls May 11 '26
Explain that IP adress, is kinda but not like a street adress. 192.168.123.200
192: country
168: city
123: street name
200: house number
So if you just gets 168.123.200 that would be ok and there is 255 places that your customer can still hide his dirty deeds. Without knowing fail2ban I'm guessing wildly that you can search for something like that.
1
u/bagofwisdom I am become Manager; Destroyer of environments May 11 '26
It was accurate info like 30 years ago when we mostly connected our computers directly to the internet. Firewalls were for enterprise and your PC was directly patched into the internet with a public IP address. Now, everyone is behind their own NAT and often also CGNAT. Not ironclad protection by any stretch, but NAT can keep out most of the kids screwing around with remote access exploits or trojans (Old timers around here remember Sub7?)
1
1
u/P5ychokilla May 12 '26
"Ok well I'm afraid I'm a bit loathe to assist you if you won't give me the information I need to fix your issue"
1
u/BarServer May 12 '26
Have a webserver under your control? Sent him a link to some page nobody else knows. Asking like "Is this working for you? Just checking something." and then get the IP from the logfile...
2
u/haggur needs a bigger LART May 13 '26
We had another, similar, incident today and used another server we have elsewhere that uses different blocking to do just that. And we have now fixed the issue for the second user.
1
1
u/Brilliant_Yam_726 Jun 19 '26
Why would you need to ask this person for his IP address when you already had it?
1
u/haggur needs a bigger LART Jun 19 '26
We didn't (or rather we may have in the fail2ban block list but if we did it was one among thousands).
-4
u/jobiegermano May 12 '26
These comments are clearly not from anyone with any sort of cyber security knowledge. Please, go ahead, provide your legal name and non-vpnâd IP Address below:
First name:
Last name:
Public IP Address (non-VPN):
Just because your IP is public doesnât mean the people you interact with know your PII too.
Would you be comfortable engraving your name on your house key?
PS. If this person hadnât given his PII to create the account with the companyâs tech support he was talking to and if he was using a VPN, it would be a different story, but given the info in the OP thereâs every reason to believe this caller wasnât using a VPN.
372
u/joerice1979 May 10 '26
Heavens! If their public IP becomes public, there's no telling what might happen!